System Threats

System Threats

1. Malware

   • Software written with the purpose of commiting a crime such as fraud and identity theft
   • Effects of Malware
     • Can cause the computer to crash
     • Files may be deleted
     • Can cause the computer to slow down
   • Examples
     • Trojans
     • key logger
     • Spyware
     • virus
   • Prevention
     • Strong security software (should be kept updated)
       • firewall
       • spam filter
       • anti-virus
       • anti-spyware
       • anti-spam
     • Enable OS updates
     • Staff training (Caution when opening attachments)
     • Backup files regularly

2. Phishing

   • An online fruad technique used by criminals to get people to disclose info by disguising as a trustworthy person
   • Prevention
     • Strong security software
       • firewall
       • spam filter
       • anti-virus
       • anti-spam
     • Staff training
       • Awareness of spotting fake websites & emails
       • never disclose personal or financial info
       • disable pop-ups
   • Examples
     • Pretending to be well known institutions
     • Spamming fake messages
   • Effects of Phishing
     • Accesing a victim's account to withdraw money or purchase mercahndise or services
     • Openiing a new account in the victim's names
     • gaining access to high-value corporate data
     • Financial services can blacklist the victim, cuasing reputational damage

3. Brute force attacks

   • A trial and error method used to decode encrypted data such as passwords or data encriptions
   • Effects of brute force attacks
     • Theft of data
     • Access to corporate systems
   • Prevention
     • Network lockout policy (locks out after a number of attempts)
     • Effective software (progressive delays)
     • Staff training
       • using effective passwords that contain symbols and numbers
     • challenge response tests (reCAPTCHA)

4. Denial of Service Attack

   • Flooding a server with useless data causing the server to become overloaded. Preventing them from responding to legitimate client-server request
   • Effects of denial of service
     • Revenue loss
       • Average cost of downtime is £4000/minute
     • Productivity loss
       • when critical network systems are shut down, workforce's productivity comes to a halt
     • Reputation damage
       • The brand suffers if customers can't access the service
   • Prevention
     • Strong security software
       • firewall
     • packet filters on routers

5. Data interception and theft

   • An attacker monitors data streams to or from a target. With a simple packet sniffer program, an attacker can easily read all plaintext traffic
   • Effects of Data interception
     • Discovering usernames and passwprds
     • Gain access to systems
     • Disclosure of corporate data
     • Theft of data
   • Prevention
     • Strong encrytion
     • Using virtual networks
     • Staff training
       • use of passowrds
       • protable storage devices
     • network forensics

6. SQL Injection

   • A code injection technique used to attack data-driven apps. If a database app has not been coded in a secure way, code can be entered into text boxes and will be executed by the server
   • Effects of SQL injecton
     • Contents of the database can be outputted
     • Data can be amended or deleted
     • New rogue records can be added
   • Prevention
     • Validation of input fields
     • Using parameterised queries
     • Using database permissions
     • penetration testing

Imagens e arquivos do mapa